scryer 0.3.0 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9cd7338bfd390fb74f2a1fae54f3132250ae75bd721bc1f65c42f9b80899e2e8
-  data.tar.gz: 984d8060977af0b21d2740384664350f9ee2b08e846bbdf71e3f069af40db386
+  metadata.gz: 4d053e64db4a99c6ea79407677ebe96ac57391e4e9e8442e0246286bbc5f02b3
+  data.tar.gz: c3f2850013d4e85d18c317b6c208a97efd79b29f88fa56d573d98788e8527219
 SHA512:
-  metadata.gz: 7d88896585a86b731a7d0600036f9fc4fe75195fa55d41296670e8e63834ead37f2a699f4865ebd77181802022964ece7c3634559bdc2d7699a0084f805c7feb
-  data.tar.gz: 110d568db0d07ee2cb649ba10ca18c324bb8cf073aef7fe3ca2e866c9e994ed5356d3fc88507ff22b32078cd42f74b8d2792a0c3b0857dcc183d6a5ae13b15cb
+  metadata.gz: 9cb23f7a30cdf2660cd208589134b265d213547d73d014ccfafba7729665b78ed5dad3125fd08c30d637c067d6051584e8ffa4a578bd9a40b9b932a96071c78d
+  data.tar.gz: 6ae2daecc08965c60a8ce1097a95721993e0fcfb5e772c1f10f88f552f07f8609212248a03588026cb180b1b1e50de7ec8f2188672163aaf7118d2560aaaebfb

data/CHANGELOG.md

@@ -3,6 +3,74 @@
 All notable changes to this project are documented here. Format loosely follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.0.0] - 2026-08-13
+
+Seventeen new security rules, a SARIF report format, a Ruby end-of-life check, and a
+credentials-exposure check — see the README's "Scryer vs RuboCop vs Brakeman vs bundler-audit"
+section for how the new security coverage is positioned (heuristic pattern-matching, not taint
+analysis; `idor` in particular carries real false-positive risk by nature of the problem).
+
+- New security rules (all `category: "security"`, skippable individually via `--skip RULE_ID` /
+  `c.skip_rules`, same as every other rule):
+  - `force_ssl_disabled` — `config.force_ssl = false`.
+  - `weak_session_cookie` — `session_store :cookie_store` with no `secure: true`.
+  - `insecure_cookie_serializer` — `cookies_serializer = :marshal` (Rails defaults to the safe
+    `:json`; only an explicit opt-out is flagged).
+  - `authentication_bypass` — `skip_before_action` naming a common auth filter
+    (`authenticate_user!`, etc.).
+  - `hardcoded_basic_auth` — `http_basic_authenticate_with` with a literal `password:`.
+  - `idor` — `Model.find(params[...])` in a controller with no visible authorization call
+    (`authorize`/`policy_scope`/`can?`) anywhere in the class. The least precise rule in the gem —
+    expect real false positives on admin-gated or genuinely-global-model controllers.
+  - `ssrf` — an outbound HTTP call (`Net::HTTP`, `URI.open`/bare `open`, `HTTParty`, `Faraday`,
+    `RestClient`) with a `params`-derived URL.
+  - `path_traversal` — a filesystem call (`File.*`, `Dir.*`, `send_file`) with a `params`-derived
+    path; recognizes `File.basename(...)` as sanitization and doesn't flag it.
+  - `active_storage_missing_content_type_validation` — `has_one_attached`/`has_many_attached` with
+    no matching `validates ..., content_type: [...]`.
+  - `active_storage_inline_disposition` — `disposition: "inline"` on a blob/variant URL helper.
+  - `security_headers_disabled` — an explicit insecure override of a Rails default security
+    header/config: `X-Frame-Options`/`X-Content-Type-Options` set to `ALLOWALL`/falsy via
+    `config.action_dispatch.default_headers`, or `config.content_security_policy = nil`. Absence of
+    a header isn't flagged, same reasoning as `force_ssl_disabled`.
+  - `cors_misconfiguration` — a wildcard `origins '*'` combined with `credentials: true` on a
+    `resource` call anywhere in the same file (the standard Rack::Cors antipattern; either half
+    alone is fine). Checked file-wide rather than same-block, same looseness as `idor`.
+  - `jwt_insecure_usage` — `JWT.decode(token, secret, false, ...)` (signature verification
+    disabled), `algorithm: 'none'`/`'alg' => 'none'`, or a literal string passed directly as the
+    secret/key argument to `JWT.decode`/`JWT.encode`.
+  - `action_cable_forgery_protection_disabled` —
+    `config.action_cable.disable_request_forgery_protection = true`.
+  - `hardcoded_secret_key_base` — `config.secret_key_base = "literal"`, a `.field=` shape
+    `hardcoded_secret` misses (its target-name lookup returns the receiver's name — `config` —
+    rather than the attribute being assigned; see this new rule's comment for the full
+    explanation).
+  - `job_raw_params` — `SomeJob.perform_async`/`perform_later`/`perform_now` called with an
+    argument that references `params` — Sidekiq stores job args in Redis in plaintext (visible in
+    its web UI) and both Sidekiq and ActiveJob log them by default.
+  - `graphql_missing_query_limits` — a `class X < GraphQL::Schema` with no `max_depth` or
+    `max_complexity` call anywhere in its body (one finding per class, not per missing directive).
+- New `Scryer::DependencyAudit.credentials_exposure_check` — flags `config/master.key` existing on
+  disk with no `.gitignore` line excluding it (checks both `/config/master.key` and
+  `config/master.key` forms). Runs alongside the other dependency checks (same
+  `--no-deps`/`nodeps` opt-out).
+- New shared `Ast` helpers backing the above (and available to any future rule):
+  `references_params?`, `keyword_arg`, `literal_text`, `true_literal?`/`false_literal?`. Also
+  fixed `Ast.call_name` to recognize `:command_call` nodes (`config.session_store :x, y: z` —
+  receiver + args, no parens), which it previously returned `nil` for.
+- New `Scryer::DependencyAudit.ruby_eol_check` — flags the Ruby version pinned in Gemfile.lock's
+  `RUBY VERSION` section if its series is past Ruby's own published end-of-life date. Runs
+  automatically alongside the other dependency checks (same `--no-deps`/`nodeps` opt-out).
+  Deliberately not a general Ruby-interpreter CVE feed — OSV.dev has no queryable ecosystem for
+  that, and a maintained local CVE list would be exactly the kind of stale bundled knowledge base
+  this gem avoids elsewhere; EOL dates, unlike CVEs, are announced years ahead and don't change.
+- New `.sarif` report format (`scryer -o report.sarif` / `scryer:report[sarif]`) — SARIF 2.1.0,
+  the format GitHub Code Scanning and similar CI dashboards ingest natively for inline PR
+  annotations. Pure mapping of the same data every other format has; see the README's new
+  "CI/CD integration" section for a GitHub Actions example.
+- Fixed: dependency-finding display (HTML and CSV) dropped a finding's `title` entirely when it had
+  no `advisory_id` (true for the new `ruby_eol` finding) instead of showing the title on its own.
+
 ## [0.3.0] - 2026-08-11
 
 - New `scryer -r PATH`/`--require PATH` flag (repeatable): requires a Ruby file before scanning.
@@ -60,6 +128,7 @@ Initial release.
   actual request handling.
 - `scryer` standalone executable and `scryer:report`/`scryer:audit_dependencies` Rails rake tasks.
 
+[1.0.0]: https://github.com/ramlaxmanyadav/scryer/releases/tag/v1.0.0
 [0.3.0]: https://github.com/ramlaxmanyadav/scryer/releases/tag/v0.3.0
 [0.2.0]: https://github.com/ramlaxmanyadav/scryer/releases/tag/v0.2.0
 [0.1.0]: https://github.com/ramlaxmanyadav/scryer/releases/tag/v0.1.0

data/README.md

@@ -23,12 +23,12 @@ scryer
 Scryer Audit — 236 files scanned
 ────────────────────────────────
 
-Security                8 findings
+Security               13 findings
 Performance            10 findings
 Code Quality          248 findings
 Dependencies           24 findings
 ────────────────────────────────
-Total                 290 findings
+Total                 295 findings
 
 JSON report: tmp/scryer_report.json
 HTML report: tmp/scryer_report.html
@@ -45,12 +45,28 @@ below for exactly how it stacks up against the tools it's meant to consolidate.
 * SQL injection
 * Mass assignment
 * Command injection
-* Hardcoded secrets
+* Hardcoded secrets (and hardcoded HTTP Basic Auth credentials)
 * Unsafe deserialization
 * XSS-prone HTML
 * CSRF gaps
 * Weak cryptography
 * Open redirects
+* Server-side request forgery (SSRF)
+* Path traversal
+* Insecure direct object references (IDOR) — the least precise check in the gem; see
+  [comparison table](#scryer-vs-rubocop-vs-brakeman-vs-bundler-audit) for the false-positive tradeoff
+* Authentication filters explicitly skipped (`skip_before_action`)
+* Rails security configuration: disabled HTTPS enforcement, session cookies missing the secure
+  flag, the Marshal cookie serializer, disabled default security headers (`X-Frame-Options`,
+  `X-Content-Type-Options`, Content-Security-Policy), Action Cable request forgery protection
+  disabled, a hardcoded `secret_key_base`
+* Active Storage attachments without a content-type allowlist, or served with inline disposition
+* CORS misconfiguration (wildcard origin combined with `credentials: true`)
+* Insecure JWT usage (`JWT.decode` with signature verification disabled, `algorithm: 'none'`, or a
+  hardcoded secret)
+* Background jobs (`perform_async`/`perform_later`/`perform_now`) passed raw `params` — risks
+  leaking request data into Sidekiq/ActiveJob logs, Redis, or the Sidekiq web UI
+* GraphQL schemas with no query depth/complexity limit (`max_depth`/`max_complexity`)
 
 **Code quality**
 
@@ -71,6 +87,8 @@ below for exactly how it stacks up against the tools it's meant to consolidate.
 
 * Known dependency vulnerabilities via OSV.dev
 * Insecure gem sources
+* Ruby version end-of-life (no more security patches published for it, for any issue)
+* `config/master.key` present on disk with no matching `.gitignore` entry
 
 ### Example findings
 
@@ -185,21 +203,24 @@ before acting on it.
 Scryer isn't trying to out-lint RuboCop or out-analyze Brakeman — where an existing tool
 specializes, it's still worth running on its own; style/lint conventions are almost entirely
 RuboCop's job, and Scryer stays out of that territory except for one narrow, deliberately-scoped
-check (see footnote below). What Scryer actually replaces is *stitching several of these together
-yourself*: it covers categories none of the others do alone (performance heuristics,
-duplicate-code detection, runtime query analysis), and folds the categories they *do* cover into
-one command and one report instead of several separate tools, configs, and CI steps.
+check (see footnote below). Brakeman also remains the deeper, more mature tool for the security
+categories it's spent years on — real taint/data-flow analysis, not heuristic pattern-matching.
+What Scryer actually replaces is *stitching several of these together yourself*: it covers
+categories none of the others do alone (performance heuristics, duplicate-code detection, runtime
+query analysis, SSRF/path-traversal/IDOR/auth-config checks), and folds the categories they *do*
+cover into one command and one report instead of several separate tools, configs, and CI steps.
 
 | Capability                               | Scryer | RuboCop  | Brakeman | bundler-audit |
 |-------------------------------------------|:------:|:--------:|:--------:|:-------------:|
 | Style/lint conventions                     | Partial [h] | ✅  | ❌       | ❌            |
-| Rails security scanning                    | ✅     | ❌       | ✅       | ❌            |
+| Rails security scanning                    | ✅ [i] | ❌       | ✅       | ❌            |
 | Performance heuristics                     | ✅     | Partial [a] | ❌    | ❌            |
 | Duplicate/similar code detection           | ✅     | Partial [b] | ❌    | ❌            |
 | Dependency vulnerability scanning          | ✅     | ❌       | ❌       | ✅            |
 | Runtime query analysis (N+1 in production) | ✅     | ❌       | ❌       | ❌            |
 | HTML report                                | ✅     | Partial [c] | ✅    | ❌            |
 | JSON report                                | ✅     | ✅       | ✅       | Limited [d]   |
+| SARIF report (GitHub Code Scanning, etc.)  | ✅     | ❌       | ✅       | ❌            |
 | Human-reviewable fix suggestions           | ✅     | Partial [e] | Partial [f] | Limited [g] |
 | Single command covering all of the above   | ✅     | ❌       | ❌       | ❌            |
 
@@ -219,8 +240,17 @@ one command and one report instead of several separate tools, configs, and CI st
   (`frozen_string_literal`, info severity). Everything else in RuboCop's style/lint domain —
   naming, layout, quote style, line length, and hundreds more — is intentionally out of scope; see
   [Skipping rules](#skipping-rules) if you don't want even this one.
-
-If you already run RuboCop for style, keep it — Scryer isn't a replacement for it. If you're
+- **[i]** Heuristic pattern-matching, not taint/data-flow analysis — Brakeman traces whether user
+  input can actually *reach* a sink; Scryer checks whether a known-dangerous call shape and a
+  `params` reference appear in the same expression. That's a real precision gap on the harder
+  checks especially (`idor` in particular has real false-positive risk — see
+  [What Scryer detects](#what-scryer-detects)), and it's why every finding says "review this,"
+  never "this is definitely a bug."
+
+If you already run RuboCop for style, keep it — Scryer isn't a replacement for it. If you already
+run Brakeman for its deeper security analysis, Scryer is a complement, not a swap — the categories
+they both cover benefit from two different heuristics looking; the ones only Scryer covers
+(performance, duplication, runtime queries, dependency EOL) are net-new either way. If you're
 currently running Brakeman + bundler-audit + a duplicate-code linter as three separate steps,
 Scryer is the "run one thing instead" option.
 
@@ -257,8 +287,8 @@ bin/rails scryer:report   # writes tmp/scryer_report.{json,html}
 By default this writes both `tmp/scryer_report.json` and `tmp/scryer_report.html`, and includes a
 dependency audit against `Gemfile.lock` (needs network — see [Dependency audit](#dependency-audit);
 pass the `nodeps` arg for a fast, fully offline run instead). Format and output path are
-configurable via task args — any mix of `json`, `html`, `csv` plus at most one path (quote the
-whole thing so your shell doesn't eat the brackets/commas, e.g.
+configurable via task args — any mix of `json`, `html`, `csv`, `sarif` plus at most one path (quote
+the whole thing so your shell doesn't eat the brackets/commas, e.g.
 `bin/rails 'scryer:report[json,doc/security_report.json]'`). Rake splits bracket args on every
 comma, so each format is its own item in the list rather than one comma-joined string
 (`scryer:report[json,html]` is two args, not `"json,html"` as one). At most one non-format,
@@ -298,11 +328,55 @@ Open `tmp/scryer_report.html` in a browser — it's a single self-contained file
 external assets, works offline) with an overview, a summary of counts by severity, the full list
 of checks that ran, a breakdown of warnings by type, every finding in detail, and duplicate-code
 groups — laid out similarly to a Brakeman report. `tmp/scryer_report.json` has the same data in
-machine-readable form, for feeding into your own dashboard or CI gate. A third format, `.csv`
-(`scryer -o report.csv` / `rails 'scryer:report[csv]'`), is a flat one-row-per-finding table
+machine-readable form, for feeding into your own dashboard or CI gate. `.csv`
+(`scryer -o report.csv` / `rails 'scryer:report[csv]'`) is a flat one-row-per-finding table
 (security + performance findings, plus dependency findings unless `--no-deps`/`nodeps` was used) —
-handy for dropping into a spreadsheet or importing into a ticketing tool. It skips duplicate-code
-groups, which don't reduce to a single actionable row.
+handy for dropping into a spreadsheet or importing into a ticketing tool; it skips duplicate-code
+groups, which don't reduce to a single actionable row. `.sarif` (`scryer -o report.sarif` /
+`rails 'scryer:report[sarif]'`) is for feeding into a CI security dashboard instead — see
+[CI/CD integration](#cicd-integration).
+
+## CI/CD integration
+
+`scryer -o report.sarif` writes a [SARIF 2.1.0](https://docs.oasis-open.org/sarif/sarif/v2.1.0/)
+report — the format GitHub Code Scanning, Azure DevOps, and most CI security dashboards ingest
+natively, turning findings into inline pull-request annotations and Security-tab entries instead
+of a report file nobody opens. It's a pure mapping of the same data every other format has —
+security, performance, and style findings (each mapped from `Scryer::Rule.rule_id`/`severity`) plus
+dependency findings (mapped from `kind`, located at `Gemfile.lock`) — so nothing behaves any
+differently than it does in HTML/JSON/CSV.
+
+Upload it with GitHub's own action in a workflow:
+
+```yaml
+# .github/workflows/scryer.yml
+name: Scryer
+on: [push, pull_request]
+
+jobs:
+  scryer:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write   # required to upload SARIF
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.3"
+      - run: gem install scryer
+      - run: scryer -o scryer.sarif
+        continue-on-error: true   # let the upload step run even on a non-zero exit; see below
+      - uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: scryer.sarif
+```
+
+`continue-on-error: true` on the scan step matters: `scryer` exits non-zero when it finds anything
+(see [Running a scan](#running-a-scan)), which would otherwise skip the upload step entirely on
+the run where you most want to see the results. If you want the job to still fail the build overall
+on findings, check `scryer`'s own exit code in a separate step, or drop `continue-on-error` and
+accept that the SARIF upload only happens on clean runs.
 
 ## What gets scanned
 
@@ -413,11 +487,12 @@ runs automatically as part of every `scryer`/`scryer:report` scan — pass `--no
 `bundle-audit check` is a separate, standalone command from your test suite. Either way it exits
 non-zero if anything is found, so it can gate CI.
 
-Two checks run, and either can be called on its own as a library:
+Three checks run, and any of them can be called on its own as a library:
 
 ```ruby
 Scryer::DependencyAudit.insecure_sources(Rails.root.to_s)  # offline — no network needed
 Scryer::DependencyAudit.vulnerable_gems(Rails.root.to_s)   # needs network (OSV.dev)
+Scryer::DependencyAudit.ruby_eol_check(Rails.root.to_s)    # offline — checked against a small embedded table
 ```
 
 - **Insecure sources**: flags any `GIT`/`PATH` block in `Gemfile.lock` whose `remote:` is
@@ -428,10 +503,20 @@ Scryer::DependencyAudit.vulnerable_gems(Rails.root.to_s)   # needs network (OSV.
   name, so checking them against RubyGems advisories could misattribute or miss vulnerabilities),
   queries OSV.dev for known vulnerabilities affecting that exact version. Each finding carries the
   advisory id, title, a severity bucketed from OSV's own severity level, a link to the advisory,
-  and the fixed version(s) to upgrade to.
+  and the fixed version(s) to upgrade to. This is also where Rails-framework CVEs surface —
+  `rails`/`actionview`/`activestorage`/etc. are just gems in `Gemfile.lock` like any other.
+- **Ruby EOL**: checks the Ruby version pinned in `Gemfile.lock`'s `RUBY VERSION` section against
+  Ruby's own [published end-of-life dates](https://www.ruby-lang.org/en/downloads/branches/) — once
+  a series is EOL, no security patches are published for it at all, for any issue, regardless of
+  how up to date every gem is. Unlike the two checks above, this doesn't call OSV.dev: EOL dates
+  are announced years in advance and essentially never change, so a small embedded table
+  (`DependencyAudit::RUBY_EOL_DATES`) is a one-time/occasional-update cost rather than a live feed
+  — deliberately not a general Ruby-interpreter CVE database, which would mean maintaining exactly
+  the kind of stale bundled knowledge base this gem avoids elsewhere (OSV.dev has no queryable
+  Ruby-interpreter ecosystem to query live instead).
 
 **From the `scryer` executable** (outside a Rails app, or in CI): `scryer --audit-deps` runs the
-same two checks standalone (no static scan), same output/exit-code behavior as the rake task above.
+same three checks standalone (no static scan), same output/exit-code behavior as the rake task above.
 Plain `scryer` already folds them into the normal `-o` report — one HTML/JSON/CSV file covering
 static findings *and* dependency findings together — so `--audit-deps` is only for when you want
 dependency findings *without* the static scan. And for a single gem, without touching

data/lib/scryer/ast.rb

@@ -64,14 +64,17 @@ module Scryer
     # Returns the receiver node (nil for a bare/vcall) and the method name
     # string if `node` is a call to one of `method_names`, else nil.
     #
-    # Handles the two shapes Ripper produces for a called method:
-    #   [:call, receiver, [:@period,...]|:"::", [:@ident, "name", pos]]  (has a receiver)
-    #   [:vcall, [:@ident, "name", pos]]                                 (bare, no args)
-    #   [:command, [:@ident, "name", pos], args]                         (bare, with args, no parens)
-    #   [:method_add_arg, call_or_fcall_node, args_node]                 (receiver/bare + parens)
+    # Handles the shapes Ripper produces for a called method:
+    #   [:call, receiver, [:@period,...]|:"::", [:@ident, "name", pos]]        (has a receiver, parens or no args)
+    #   [:vcall, [:@ident, "name", pos]]                                       (bare, no args)
+    #   [:fcall, [:@ident, "name", pos]]                                       (bare + parens, no receiver)
+    #   [:command, [:@ident, "name", pos], args]                               (bare, with args, no parens)
+    #   [:command_call, receiver, [:@period,...], [:@ident, "name", pos], args] (receiver + args, no parens —
+    #                                                                            e.g. `config.session_store :x, y: z`)
+    #   [:method_add_arg, call_or_fcall_node, args_node]                       (receiver/bare + parens, wraps one of the above)
     def call_name(node)
       case node
-      when ->(n) { tagged?(n, :call) }
+      when ->(n) { tagged?(n, :call, :command_call) }
         [node[1], ident_text(node[3])]
       when ->(n) { tagged?(n, :vcall) }
         [nil, ident_text(node[1])]
@@ -247,6 +250,66 @@ module Scryer
       result
     end
 
+    # Given a list of top-level argument nodes (from call_arguments), finds
+    # the bare_assoc_hash entry whose label matches `label:` and returns its
+    # value node, or nil if that keyword argument isn't present. Covers
+    # Rails DSL calls like `session_store :cookie_store, secure: true` or
+    # `http_basic_authenticate_with password: "x"`, where keyword args
+    # arrive as a bare_assoc_hash rather than a real Hash literal.
+    def keyword_arg(args, label)
+      target = "#{label}:"
+
+      args.each do |arg|
+        next unless tagged?(arg, :bare_assoc_hash) && arg[1].is_a?(Array)
+
+        pair = arg[1].find { |p| tagged?(p, :assoc_new) && p[1].is_a?(Array) && p[1][0] == :@label && p[1][1] == target }
+        return pair[2] if pair
+      end
+
+      nil
+    end
+
+    # The literal text of a symbol_literal (`:inline`) or plain string_literal
+    # (`"inline"`) node — the two shapes a Rails DSL keyword argument's value
+    # commonly takes. nil for anything else (interpolated string, array,
+    # boolean, ...).
+    def literal_text(node)
+      return plain_string_value(node) if tagged?(node, :string_literal)
+      return nil unless tagged?(node, :symbol_literal) && node[1].is_a?(Array)
+
+      ident_text(node[1][1]) if tagged?(node[1], :symbol)
+    end
+
+    # True if `node` is the literal `true`/`false` keyword
+    # (`[:var_ref, [:@kw, "true"|"false", pos]]`).
+    def true_literal?(node)
+      kw_literal?(node) == "true"
+    end
+
+    def false_literal?(node)
+      kw_literal?(node) == "false"
+    end
+
+    def kw_literal?(node)
+      return nil unless tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@kw
+
+      node[1][1]
+    end
+
+    # True if `node` is `params`, `params[:x]`, or contains such a reference
+    # anywhere in its subtree — the shared "does this touch raw request data"
+    # check behind mass assignment, IDOR, SSRF, and path traversal detection.
+    # Says nothing about whether that reference is guarded (`.permit`,
+    # sanitization, an allowlist, ...) — callers that care about a specific
+    # guard (like MassAssignmentRule's `.permit`) check for it separately.
+    def references_params?(node)
+      return false unless node.is_a?(Array)
+
+      each_node(node).any? do |n|
+        tagged?(n, :vcall, :var_ref, :fcall) && ident_text(n[1]) == "params"
+      end
+    end
+
     # Walks every terminal token-bearing node inside `node` and maps it to a
     # normalized symbol: identifiers/literals become placeholders (so renamed
     # variables/changed literal values still count as "the same" shape),

data/lib/scryer/cli.rb

@@ -9,7 +9,7 @@ module Scryer
   # only needed for this CLI entry point, not when the gem is required
   # inside a host app.
   class CLI
-    EXTENSION_FORMATS = { ".json" => "json", ".html" => "html", ".htm" => "html", ".csv" => "csv" }.freeze
+    EXTENSION_FORMATS = { ".json" => "json", ".html" => "html", ".htm" => "html", ".csv" => "csv", ".sarif" => "sarif" }.freeze
 
     def initialize(argv, stdout: $stdout, stderr: $stderr)
       @argv = argv
@@ -50,7 +50,8 @@ module Scryer
       dependency_findings = []
       if ran_deps
         @stdout.puts "Scryer: querying OSV.dev for known-vulnerable gems (needs network)..."
-        dependency_findings = DependencyAudit.insecure_sources(root) + DependencyAudit.vulnerable_gems(root)
+        dependency_findings = DependencyAudit.insecure_sources(root) + DependencyAudit.vulnerable_gems(root) +
+                               DependencyAudit.ruby_eol_check(root) + DependencyAudit.credentials_exposure_check(root)
       end
 
       if Scryer.configuration.ai_client
@@ -91,18 +92,28 @@ module Scryer
 
       @stdout.puts "Scryer: querying OSV.dev for known vulnerabilities (needs network)..."
       vulnerable = DependencyAudit.vulnerable_gems(root)
+      ruby_eol = DependencyAudit.ruby_eol_check(root)
+      credentials_exposure = DependencyAudit.credentials_exposure_check(root)
 
-      (insecure + vulnerable).each do |f|
-        label = f.kind == "insecure_source" ? "[#{f.severity.upcase}] #{f.message}" : "[#{f.severity.upcase}] #{f.gem_name} #{f.installed_version} - #{f.advisory_id}: #{f.title}"
-        @stdout.puts label
+      (insecure + vulnerable + ruby_eol + credentials_exposure).each do |f|
+        @stdout.puts "[#{f.severity.upcase}] #{dependency_label(f)}"
         @stdout.puts "  fix: #{f.suggested_fix}"
       end
 
-      total = insecure.size + vulnerable.size
-      @stdout.puts "\nScryer: #{total} dependency finding(s) (#{insecure.size} insecure source, #{vulnerable.size} vulnerable gem)."
+      total = insecure.size + vulnerable.size + ruby_eol.size + credentials_exposure.size
+      @stdout.puts "\nScryer: #{total} dependency finding(s) (#{insecure.size} insecure source, " \
+                   "#{vulnerable.size} vulnerable gem, #{ruby_eol.size} Ruby EOL, " \
+                   "#{credentials_exposure.size} credentials exposure)."
       total.positive? ? 1 : 0
     end
 
+    def dependency_label(f)
+      return f.message if f.kind == "insecure_source"
+      return "#{f.gem_name} #{f.installed_version} - #{f.advisory_id}: #{f.title}" if f.advisory_id
+
+      "#{f.gem_name} #{f.installed_version}: #{f.title}"
+    end
+
     # The "one audit command" summary — a single scan's worth of every
     # category Scryer covers (security, performance, duplicate/smelly code,
     # dependencies), the same categories usually split across RuboCop +
@@ -165,7 +176,7 @@ module Scryer
         opts.banner = "Usage: scryer [options]"
         opts.on("-o PATH", "--output PATH",
                 "Write a report to PATH (repeatable). Format is inferred from the " \
-                "extension: .json, .html, or .csv.") { |v| options[:outputs] << v }
+                "extension: .json, .html, .csv, or .sarif.") { |v| options[:outputs] << v }
         opts.on("-p PATH", "--path PATH", "Root directory to scan (default: current directory).") { |v| options[:path] = v }
         opts.on("-r PATH", "--require PATH",
                 "Require a Ruby file before scanning (repeatable) — the file can call " \
@@ -212,6 +223,7 @@ module Scryer
       content = case format
                 when "json" then renderer.as_json
                 when "csv" then renderer.as_csv
+                when "sarif" then renderer.as_sarif
                 else renderer.as_html
                 end
 

data/lib/scryer/dependency_audit.rb

@@ -1,4 +1,5 @@
 require "json"
+require "date"
 
 module Scryer
   # Dependency vulnerability + supply-chain-hygiene checks for Gemfile.lock —
@@ -55,15 +56,35 @@ module Scryer
       "LOW" => "info"
     }.freeze
 
+    # Ruby's own published maintenance-branch EOL dates
+    # (ruby-lang.org/en/downloads/branches/) — these are announced years in
+    # advance and essentially never move, unlike a CVE feed, so this is a
+    # one-time/occasional-update cost rather than an ongoing sync burden.
+    # Update when a new branch's EOL is announced, or an older branch not
+    # listed here needs adding.
+    RUBY_EOL_DATES = {
+      "2.5" => Date.new(2021, 3, 31),
+      "2.6" => Date.new(2022, 3, 31),
+      "2.7" => Date.new(2023, 3, 31),
+      "3.0" => Date.new(2024, 3, 31),
+      "3.1" => Date.new(2025, 3, 31),
+      "3.2" => Date.new(2026, 3, 31),
+      "3.3" => Date.new(2027, 3, 31),
+      "3.4" => Date.new(2028, 3, 31)
+    }.freeze
+
     class << self
-      # Parses a Gemfile.lock into `{ gems: { name => {version:, source:} }, git_or_path_sources: [...] }`.
-      # `source` is "gem", "git", or "path" — taken from which top-level
-      # block (GEM/GIT/PATH) the spec's `specs:` list appeared under.
+      # Parses a Gemfile.lock into `{ gems: { name => {version:, source:} },
+      # git_or_path_sources: [...], ruby_version: "3.3.3" | nil }`. `source`
+      # is "gem", "git", or "path" — taken from which top-level block
+      # (GEM/GIT/PATH) the spec's `specs:` list appeared under.
       def parse_lockfile(path)
         gems = {}
         git_or_path_sources = []
+        ruby_version = nil
 
-        current_block = nil # "gem" | "git" | "path" | other section name
+        current_block = nil # "gem" | "git" | "path" | nil (other section)
+        current_section = nil # PLATFORMS | DEPENDENCIES | BUNDLED WITH | RUBY VERSION | nil
         current_remote = nil
         in_specs = false
 
@@ -71,10 +92,12 @@ module Scryer
           case line
           when /\A(GEM|GIT|PATH)\s*\z/
             current_block = Regexp.last_match(1).downcase
+            current_section = nil
             current_remote = nil
             in_specs = false
           when /\A(PLATFORMS|DEPENDENCIES|BUNDLED WITH|RUBY VERSION)\s*\z/
             current_block = nil
+            current_section = Regexp.last_match(1)
             in_specs = false
           when /\A {2}remote:\s*(\S+)\s*\z/
             current_remote = Regexp.last_match(1)
@@ -90,10 +113,46 @@ module Scryer
             # in pathological Gemfiles; last one wins, consistent with how
             # Bundler itself resolves a single spec per gem name.
             gems[name] = { version: version, source: current_block }
+          when /\A\s*ruby\s+(\S+)\s*\z/
+            ruby_version = Regexp.last_match(1) if current_section == "RUBY VERSION"
           end
         end
 
-        { gems: gems, git_or_path_sources: git_or_path_sources }
+        { gems: gems, git_or_path_sources: git_or_path_sources, ruby_version: ruby_version }
+      end
+
+      # Offline. Flags the Ruby version pinned in Gemfile.lock's RUBY
+      # VERSION section if its minor series is past end-of-life — after that
+      # date Ruby publishes no more security patches for it, for any issue,
+      # so this is a real gap even with every gem otherwise up to date.
+      # Returns [] if no version is pinned, or its series isn't one
+      # RUBY_EOL_DATES knows about (never guessed as "fine" by omission).
+      def ruby_eol_check(root)
+        lockfile = File.join(root, "Gemfile.lock")
+        return [] unless File.exist?(lockfile)
+
+        ruby_version = parse_lockfile(lockfile)[:ruby_version]
+        return [] unless ruby_version
+
+        series = ruby_version[/\A\d+\.\d+/]
+        eol_date = series && RUBY_EOL_DATES[series]
+        return [] unless eol_date && Date.today > eol_date
+
+        [
+          Finding.new(
+            kind: "ruby_eol",
+            gem_name: "Ruby",
+            installed_version: ruby_version,
+            severity: "critical",
+            title: "Ruby #{series} is end-of-life",
+            url: "https://www.ruby-lang.org/en/downloads/branches/",
+            patched_versions: [],
+            message: "Ruby #{ruby_version} (#{series} series) reached end-of-life on " \
+                      "#{eol_date} — no security patches are published for it anymore, for any issue.",
+            suggested_fix: "Upgrade to a Ruby version still receiving security maintenance — see " \
+                            "https://www.ruby-lang.org/en/downloads/branches/ for current status."
+          )
+        ]
       end
 
       # Offline. Flags GIT/PATH sources recorded with an unencrypted remote
@@ -160,6 +219,41 @@ module Scryer
         findings
       end
 
+      # Offline. Flags `config/master.key` (the key that decrypts Rails
+      # encrypted credentials, config/credentials.yml.enc) if it exists on
+      # disk and .gitignore doesn't exclude it — Rails generates it
+      # gitignored by default (`/config/master.key`), but that line is easy
+      # to lose (a merge, a from-scratch .gitignore, copying the file into a
+      # repo that never had the Rails default). If this file is ever
+      # committed, anyone with repo access — including git history, even
+      # after a later removal — can decrypt every credential in
+      # config/credentials.yml.enc.
+      def credentials_exposure_check(root)
+        master_key_path = File.join(root, "config", "master.key")
+        return [] unless File.exist?(master_key_path)
+        return [] if master_key_gitignored?(root)
+
+        [
+          Finding.new(
+            kind: "credentials_exposure",
+            gem_name: "Rails",
+            severity: "critical",
+            title: "config/master.key is present and not gitignored",
+            url: "https://guides.rubyonrails.org/security.html",
+            patched_versions: [],
+            message: "config/master.key exists in this app, but .gitignore doesn't exclude it " \
+                      "(checked for both `/config/master.key` and `config/master.key`) — if this " \
+                      "file is ever committed, anyone with repository access, including git " \
+                      "history even after a later removal, can decrypt every credential in " \
+                      "config/credentials.yml.enc.",
+            suggested_fix: "Add `/config/master.key` to .gitignore immediately. If this key was " \
+                            "ever actually committed to git history, treat every credential in " \
+                            "config/credentials.yml.enc as compromised: rotate them and regenerate " \
+                            "the master key (delete both files, then `bin/rails credentials:edit`)."
+          )
+        ]
+      end
+
       # Needs network. One-off OSV.dev lookup for a single gem, independent
       # of any Gemfile.lock — backs `scryer --check-gem NAME[:VERSION]`.
       # With a version, only vulnerabilities affecting that exact version
@@ -171,6 +265,15 @@ module Scryer
 
       private
 
+      def master_key_gitignored?(root)
+        gitignore_path = File.join(root, ".gitignore")
+        return false unless File.exist?(gitignore_path)
+
+        File.foreach(gitignore_path).any? do |line|
+          line.strip.match?(%r{\A/?config/master\.key\z})
+        end
+      end
+
       def query_osv(name, version = nil)
         require "net/http"
         require "uri"